CVE-2024-0560CWE-280

Apicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versions

Medium · published February 28, 2024

CVSS v3.1
6.3
EPSS
0%
Percentile
40.9
In the wild
Unconfirmed
What it is

A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Token Introspection policy discovers the Token Introspection endpoint from the token_introspection_endpoint field, but the field was removed on RH-SSO 7.5. As a result, the policy doesn't inspect tokens, it determines that all tokens are valid.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00486 · 40.9th percentile
Weakness
CWE-280 · Improper Handling of Insufficient Permissions or Privileges
Published
2024-02-28T16:37Z
EPSS history
Timeline
  • 28 FEB 16:37Z
    Apicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versions
    cvelistv5